feat: add XAMLÉ Platform Admin super-admin interface

When selectedOrgId === 'xamle-admin-org', the admin switches to a full
platform management dashboard instead of the normal org layout.

Backend (apps/api):
- New /v1/super-admin/* routes (SUPER_ADMIN/ADMIN role required):
platform stats, organizations CRUD + suspend + impersonate,
cross-org users + role change, WhatsApp numbers, billing
transactions + manual credits, monitoring health, AI agentic command
- Fixed SQL injection in analytics text-to-SQL (UNION/DROP/comment blocking)
- Removed JWT secret fallback — crashes on startup if JWT_SECRET is missing
- Added ORG_ADMIN role guard to all /v1/admin/* routes

Frontend (apps/admin):
- SuperAdminRouter: nested routes under /platform/*
- SuperAdminLayout: dark sidebar (slate-950/violet), 7 nav items
- PlatformDashboard: 6 KPI cards, system health, active alerts
- OrganizationsManager: searchable table, suspend/edit drawer, create modal
- UsersManager: cross-org table with inline role-change
- WhatsAppNumbers: all registered numbers across orgs
- MonitoringAlerts: DB/Redis/queue health, expiring tokens, low balances
- BillingManager: transaction history, manual credit top-up modal
- AIInsights: NL chat with suggestion chips and confirmation flow

apps/admin/src/App.tsx

@@ -31,6 +31,7 @@ import { useTenant } from '@/lib/tenant';
 import { api } from '@/lib/api';
 
 import MainLayout from '@/components/layouts/MainLayout';
+import SuperAdminRouter from '@/pages/super-admin/SuperAdminRouter';
 import { logError } from '@/lib/logger';
 
 function ProtectedRoute({ children }: { children: React.ReactNode }) {
@@ -41,7 +42,7 @@ function ProtectedRoute({ children }: { children: React.ReactNode }) {
 
 function AppShell() {
     const { token, user } = useAuth();
-    const { setSelectedOrgId, currentOrg } = useTenant();
+    const { selectedOrgId, setSelectedOrgId, currentOrg } = useTenant();
     const [orgs, setOrgs] = React.useState<any[]>([]);
 
     const isSuperAdmin = user?.role === 'SUPER_ADMIN' || user?.role === 'ADMIN';
@@ -62,6 +63,10 @@ function AppShell() {
 
     const isCrmActive = !!currentOrg?.isCrmActive;
 
+    if (selectedOrgId === 'xamle-admin-org') {
+        return <SuperAdminRouter />;
+    }
+
     return (
         <MainLayout isSuperAdmin={isSuperAdmin} orgs={orgs}>
             <Routes>

apps/admin/src/pages/super-admin/AIInsights.tsx

@@ -0,0 +1,195 @@
+import { useState, useRef, useEffect } from 'react';
+import { useAuth } from '@/lib/auth';
+import { api } from '@/lib/api';
+import { useToast } from '@/hooks/useToast';
+import { Bot, Send, Loader2, Check, X } from 'lucide-react';
+
+const SUGGESTIONS = [
+    'Montre moi les organisations avec un solde faible',
+    'Quelles sont les statistiques de la plateforme ?',
+    'Liste les alertes actives',
+    'Affiche les 10 dernières organisations',
+];
+
+interface Msg {
+    role: 'user' | 'assistant';
+    content: string;
+    pending?: { action: string; params: Record<string, unknown>; summary: string };
+}
+
+export default function AIInsights() {
+    const { token } = useAuth();
+    const toast = useToast();
+    const [messages, setMessages] = useState<Msg[]>([{
+        role: 'assistant',
+        content: 'Bonjour ! Je suis votre assistant IA pour la gestion de la plateforme XAMLÉ. Posez-moi une question ou donnez-moi une instruction.',
+    }]);
+    const [input, setInput] = useState('');
+    const [loading, setLoading] = useState(false);
+    const endRef = useRef<HTMLDivElement>(null);
+
+    useEffect(() => { endRef.current?.scrollIntoView({ behavior: 'smooth' }); }, [messages]);
+
+    async function send(command?: string) {
+        const text = command || input.trim();
+        if (!text || !token) return;
+        setInput('');
+        setMessages(prev => [...prev, { role: 'user', content: text }]);
+        setLoading(true);
+
+        try {
+            const res = await api.post('/v1/super-admin/ai/command', { command: text }, token);
+
+            if (res.status === 'pending_confirmation') {
+                setMessages(prev => [...prev, {
+                    role: 'assistant',
+                    content: res.summary,
+                    pending: { action: res.action, params: res.params, summary: res.summary },
+                }]);
+            } else {
+                const resultText = formatResult(res.result);
+                setMessages(prev => [...prev, { role: 'assistant', content: resultText }]);
+            }
+        } catch {
+            toast.error('Erreur AI');
+            setMessages(prev => [...prev, { role: 'assistant', content: 'Désolé, une erreur est survenue.' }]);
+        } finally {
+            setLoading(false);
+        }
+    }
+
+    async function confirm(msg: Msg, confirmed: boolean) {
+        if (!msg.pending || !token) return;
+        setMessages(prev => prev.map(m => m === msg ? { ...m, pending: undefined } : m));
+
+        if (!confirmed) {
+            setMessages(prev => [...prev, { role: 'assistant', content: 'Action annulée.' }]);
+            return;
+        }
+
+        setLoading(true);
+        try {
+            const res = await api.post('/v1/super-admin/ai/command', {
+                command: msg.pending.summary,
+                confirm: true,
+                pendingAction: { action: msg.pending.action, params: msg.pending.params },
+            }, token);
+            setMessages(prev => [...prev, { role: 'assistant', content: formatResult(res.result) }]);
+        } catch {
+            toast.error('Erreur exécution');
+            setMessages(prev => [...prev, { role: 'assistant', content: "Erreur lors de l'exécution." }]);
+        } finally {
+            setLoading(false);
+        }
+    }
+
+    function formatResult(result: unknown): string {
+        if (!result) return 'Action effectuée.';
+        if (typeof result === 'string') return result;
+        if (Array.isArray(result)) {
+            if (result.length === 0) return 'Aucun résultat trouvé.';
+            return result.map((r: any) => {
+                if (r.name) return `• **${r.name}** — ${Object.entries(r).filter(([k]) => k !== 'name' && k !== 'id').map(([k, v]) => `${k}: ${v}`).join(', ')}`;
+                return JSON.stringify(r);
+            }).join('\n');
+        }
+        if (typeof result === 'object' && result !== null) {
+            return Object.entries(result).map(([k, v]) => `**${k}**: ${v}`).join('\n');
+        }
+        return String(result);
+    }
+
+    function renderContent(content: string) {
+        return content.split('\n').map((line, i) => {
+            const boldLine = line.replace(/\*\*(.+?)\*\*/g, (_, m) => `<strong>${m}</strong>`);
+            return <p key={i} className="text-sm" dangerouslySetInnerHTML={{ __html: boldLine }} />;
+        });
+    }
+
+    return (
+        <div className="flex flex-col h-[calc(100vh-8rem)]">
+            <div className="mb-4">
+                <h1 className="text-xl font-bold text-white">AI Insights</h1>
+                <p className="text-sm text-slate-400 mt-0.5">Commandes en langage naturel pour gérer la plateforme</p>
+            </div>
+
+            {/* Suggestions */}
+            <div className="flex flex-wrap gap-2 mb-4">
+                {SUGGESTIONS.map(s => (
+                    <button
+                        key={s}
+                        onClick={() => send(s)}
+                        className="text-xs px-3 py-1.5 bg-slate-800 hover:bg-slate-700 text-slate-300 rounded-full transition-colors border border-slate-700"
+                    >
+                        {s}
+                    </button>
+                ))}
+            </div>
+
+            {/* Chat messages */}
+            <div className="flex-1 overflow-y-auto space-y-4 bg-slate-900 rounded-xl border border-slate-800 p-4 mb-4">
+                {messages.map((msg, i) => (
+                    <div key={i} className={`flex gap-3 ${msg.role === 'user' ? 'flex-row-reverse' : ''}`}>
+                        {msg.role === 'assistant' && (
+                            <div className="w-7 h-7 rounded-full bg-violet-600 flex items-center justify-center shrink-0">
+                                <Bot className="w-4 h-4 text-white" />
+                            </div>
+                        )}
+                        <div className={`max-w-[80%] space-y-1 ${msg.role === 'user' ? 'items-end flex flex-col' : ''}`}>
+                            <div className={`rounded-xl px-4 py-2.5 ${msg.role === 'user' ? 'bg-violet-600 text-white' : 'bg-slate-800 text-slate-200'}`}>
+                                {renderContent(msg.content)}
+                            </div>
+                            {msg.pending && (
+                                <div className="flex gap-2 mt-1">
+                                    <button
+                                        onClick={() => confirm(msg, true)}
+                                        className="flex items-center gap-1.5 px-3 py-1.5 bg-emerald-600 hover:bg-emerald-500 text-white text-xs font-medium rounded-lg transition-colors"
+                                    >
+                                        <Check className="w-3 h-3" />
+                                        Confirmer
+                                    </button>
+                                    <button
+                                        onClick={() => confirm(msg, false)}
+                                        className="flex items-center gap-1.5 px-3 py-1.5 bg-slate-700 hover:bg-slate-600 text-slate-300 text-xs font-medium rounded-lg transition-colors"
+                                    >
+                                        <X className="w-3 h-3" />
+                                        Annuler
+                                    </button>
+                                </div>
+                            )}
+                        </div>
+                    </div>
+                ))}
+                {loading && (
+                    <div className="flex gap-3">
+                        <div className="w-7 h-7 rounded-full bg-violet-600 flex items-center justify-center shrink-0">
+                            <Bot className="w-4 h-4 text-white" />
+                        </div>
+                        <div className="bg-slate-800 rounded-xl px-4 py-2.5">
+                            <Loader2 className="w-4 h-4 text-slate-400 animate-spin" />
+                        </div>
+                    </div>
+                )}
+                <div ref={endRef} />
+            </div>
+
+            {/* Input */}
+            <form onSubmit={(e) => { e.preventDefault(); send(); }} className="flex gap-2">
+                <input
+                    value={input}
+                    onChange={e => setInput(e.target.value)}
+                    placeholder="Tapez une commande... ex: 'Ajoute 500 crédits à l'org XAMLÉ'"
+                    disabled={loading}
+                    className="flex-1 bg-slate-900 border border-slate-700 rounded-xl px-4 py-3 text-sm text-white placeholder-slate-500 focus:outline-none focus:border-violet-500 disabled:opacity-50"
+                />
+                <button
+                    type="submit"
+                    disabled={loading || !input.trim()}
+                    className="px-4 py-3 bg-violet-600 hover:bg-violet-500 disabled:opacity-50 text-white rounded-xl transition-colors"
+                >
+                    {loading ? <Loader2 className="w-4 h-4 animate-spin" /> : <Send className="w-4 h-4" />}
+                </button>
+            </form>
+        </div>
+    );
+}

apps/admin/src/pages/super-admin/BillingManager.tsx

@@ -0,0 +1,158 @@
+import { useState, useEffect } from 'react';
+import { useAuth } from '@/lib/auth';
+import { api } from '@/lib/api';
+import { useToast } from '@/hooks/useToast';
+import { CreditCard, Plus, X } from 'lucide-react';
+
+export default function BillingManager() {
+    const { token } = useAuth();
+    const toast = useToast();
+    const [transactions, setTransactions] = useState<any[]>([]);
+    const [total, setTotal] = useState(0);
+    const [page, setPage] = useState(1);
+    const [loading, setLoading] = useState(true);
+    const [showAddCredits, setShowAddCredits] = useState(false);
+    const [creditOrgId, setCreditOrgId] = useState('');
+    const [creditAmount, setCreditAmount] = useState('');
+    const [creditDesc, setCreditDesc] = useState('');
+    const [saving, setSaving] = useState(false);
+
+    const LIMIT = 20;
+
+    async function load() {
+        if (!token) return;
+        setLoading(true);
+        try {
+            const data = await api.get(`/v1/super-admin/billing/transactions?page=${page}&limit=${LIMIT}`, token);
+            setTransactions(data.data ?? []);
+            setTotal(data.total ?? 0);
+        } catch { toast.error('Erreur chargement transactions'); }
+        finally { setLoading(false); }
+    }
+
+    useEffect(() => { load(); }, [page, token]);
+
+    async function handleAddCredits() {
+        if (!creditOrgId || !creditAmount) return;
+        setSaving(true);
+        try {
+            const result = await api.post('/v1/super-admin/billing/credits', {
+                orgId: creditOrgId,
+                amount: parseInt(creditAmount),
+                description: creditDesc || undefined,
+            }, token);
+            toast.success(`${creditAmount} crédits ajoutés. Nouveau solde: ${result.newBalance}`);
+            setShowAddCredits(false);
+            setCreditOrgId(''); setCreditAmount(''); setCreditDesc('');
+            load();
+        } catch { toast.error('Erreur ajout de crédits'); }
+        finally { setSaving(false); }
+    }
+
+    const TYPE_COLORS: Record<string, string> = {
+        TOP_UP_MANUAL: 'text-emerald-400',
+        TOP_UP_PAYMENT: 'text-emerald-400',
+        DEBIT_AI: 'text-red-400',
+    };
+
+    return (
+        <div className="space-y-4">
+            <div className="flex items-center justify-between">
+                <div>
+                    <h1 className="text-xl font-bold text-white">Billing</h1>
+                    <p className="text-sm text-slate-400 mt-0.5">{total} transactions</p>
+                </div>
+                <button
+                    onClick={() => setShowAddCredits(true)}
+                    className="flex items-center gap-2 bg-violet-600 hover:bg-violet-500 text-white text-sm font-medium px-4 py-2 rounded-lg transition-colors"
+                >
+                    <Plus className="w-4 h-4" />
+                    Ajouter crédits
+                </button>
+            </div>
+
+            <div className="bg-slate-900 rounded-xl border border-slate-800 overflow-hidden">
+                {loading ? (
+                    <div className="p-8 text-center text-slate-500 animate-pulse">Chargement...</div>
+                ) : transactions.length === 0 ? (
+                    <div className="p-12 flex flex-col items-center gap-3 text-slate-500">
+                        <CreditCard className="w-8 h-8" />
+                        <p>Aucune transaction</p>
+                    </div>
+                ) : (
+                    <div className="overflow-x-auto">
+                        <table className="w-full text-sm">
+                            <thead>
+                                <tr className="border-b border-slate-800">
+                                    <th className="text-left px-4 py-3 text-xs font-medium text-slate-400 uppercase tracking-wider">Date</th>
+                                    <th className="text-left px-4 py-3 text-xs font-medium text-slate-400 uppercase tracking-wider">Organisation</th>
+                                    <th className="text-left px-4 py-3 text-xs font-medium text-slate-400 uppercase tracking-wider">Type</th>
+                                    <th className="text-left px-4 py-3 text-xs font-medium text-slate-400 uppercase tracking-wider">Description</th>
+                                    <th className="text-right px-4 py-3 text-xs font-medium text-slate-400 uppercase tracking-wider">Montant</th>
+                                    <th className="text-right px-4 py-3 text-xs font-medium text-slate-400 uppercase tracking-wider">Solde après</th>
+                                </tr>
+                            </thead>
+                            <tbody className="divide-y divide-slate-800">
+                                {transactions.map(t => (
+                                    <tr key={t.id} className="hover:bg-slate-800/50 transition-colors">
+                                        <td className="px-4 py-3 text-xs text-slate-400">{new Date(t.createdAt).toLocaleDateString('fr-FR')}</td>
+                                        <td className="px-4 py-3 text-slate-300">{t.organization?.name || '—'}</td>
+                                        <td className="px-4 py-3">
+                                            <span className={`text-xs font-medium ${TYPE_COLORS[t.type] ?? 'text-slate-300'}`}>{t.type}</span>
+                                        </td>
+                                        <td className="px-4 py-3 text-xs text-slate-400 max-w-xs truncate">{t.description || '—'}</td>
+                                        <td className={`px-4 py-3 text-right font-medium text-sm ${t.amount > 0 ? 'text-emerald-400' : 'text-red-400'}`}>
+                                            {t.amount > 0 ? '+' : ''}{t.amount.toLocaleString()}
+                                        </td>
+                                        <td className="px-4 py-3 text-right text-slate-300">{t.balanceAfter?.toLocaleString()}</td>
+                                    </tr>
+                                ))}
+                            </tbody>
+                        </table>
+                    </div>
+                )}
+            </div>
+
+            {total > LIMIT && (
+                <div className="flex items-center justify-between text-sm text-slate-400">
+                    <span>{((page - 1) * LIMIT) + 1}–{Math.min(page * LIMIT, total)} sur {total}</span>
+                    <div className="flex gap-2">
+                        <button onClick={() => setPage(p => Math.max(1, p - 1))} disabled={page === 1} className="px-3 py-1.5 bg-slate-900 border border-slate-700 rounded-lg disabled:opacity-40 hover:bg-slate-800 transition-colors">Précédent</button>
+                        <button onClick={() => setPage(p => p + 1)} disabled={page * LIMIT >= total} className="px-3 py-1.5 bg-slate-900 border border-slate-700 rounded-lg disabled:opacity-40 hover:bg-slate-800 transition-colors">Suivant</button>
+                    </div>
+                </div>
+            )}
+
+            {showAddCredits && (
+                <div className="fixed inset-0 bg-black/60 z-50 flex items-center justify-center">
+                    <div className="bg-slate-900 border border-slate-800 rounded-xl p-6 w-96 space-y-4">
+                        <div className="flex items-center justify-between">
+                            <h2 className="text-base font-bold text-white">Ajouter des crédits</h2>
+                            <button onClick={() => setShowAddCredits(false)}><X className="w-4 h-4 text-slate-400" /></button>
+                        </div>
+                        <div className="space-y-3">
+                            <div>
+                                <label className="text-xs font-medium text-slate-400 uppercase tracking-wider">ID de l'organisation</label>
+                                <input value={creditOrgId} onChange={e => setCreditOrgId(e.target.value)} placeholder="org-uuid..." className="mt-1.5 w-full bg-slate-800 border border-slate-700 rounded-lg px-3 py-2 text-sm text-white placeholder-slate-500 focus:outline-none focus:border-violet-500" />
+                            </div>
+                            <div>
+                                <label className="text-xs font-medium text-slate-400 uppercase tracking-wider">Montant (crédits)</label>
+                                <input type="number" value={creditAmount} onChange={e => setCreditAmount(e.target.value)} placeholder="100" className="mt-1.5 w-full bg-slate-800 border border-slate-700 rounded-lg px-3 py-2 text-sm text-white placeholder-slate-500 focus:outline-none focus:border-violet-500" />
+                            </div>
+                            <div>
+                                <label className="text-xs font-medium text-slate-400 uppercase tracking-wider">Description (optionnel)</label>
+                                <input value={creditDesc} onChange={e => setCreditDesc(e.target.value)} placeholder="Rechargement manuel..." className="mt-1.5 w-full bg-slate-800 border border-slate-700 rounded-lg px-3 py-2 text-sm text-white placeholder-slate-500 focus:outline-none focus:border-violet-500" />
+                            </div>
+                        </div>
+                        <div className="flex gap-2">
+                            <button onClick={() => setShowAddCredits(false)} className="flex-1 py-2 bg-slate-800 hover:bg-slate-700 text-slate-300 text-sm rounded-lg transition-colors">Annuler</button>
+                            <button onClick={handleAddCredits} disabled={saving || !creditOrgId || !creditAmount} className="flex-1 py-2 bg-violet-600 hover:bg-violet-500 disabled:opacity-50 text-white text-sm font-medium rounded-lg transition-colors">
+                                {saving ? 'Ajout...' : 'Ajouter'}
+                            </button>
+                        </div>
+                    </div>
+                </div>
+            )}
+        </div>
+    );
+}

apps/admin/src/pages/super-admin/MonitoringAlerts.tsx

@@ -0,0 +1,119 @@
+import { useState, useEffect } from 'react';
+import { useAuth } from '@/lib/auth';
+import { api } from '@/lib/api';
+import { useToast } from '@/hooks/useToast';
+import { RefreshCw, AlertTriangle, CheckCircle, XCircle } from 'lucide-react';
+
+export default function MonitoringAlerts() {
+    const { token } = useAuth();
+    const toast = useToast();
+    const [health, setHealth] = useState<any>(null);
+    const [loading, setLoading] = useState(true);
+
+    async function load() {
+        if (!token) return;
+        setLoading(true);
+        try {
+            const data = await api.get('/v1/super-admin/monitoring/health', token);
+            setHealth(data);
+        } catch { toast.error('Erreur chargement monitoring'); }
+        finally { setLoading(false); }
+    }
+
+    useEffect(() => { load(); }, [token]);
+
+    return (
+        <div className="space-y-6">
+            <div className="flex items-center justify-between">
+                <div>
+                    <h1 className="text-xl font-bold text-white">Monitoring & Alertes</h1>
+                    <p className="text-sm text-slate-400 mt-0.5">État en temps réel du système</p>
+                </div>
+                <button onClick={load} className="flex items-center gap-2 px-3 py-2 bg-slate-800 hover:bg-slate-700 text-slate-300 text-sm rounded-lg transition-colors">
+                    <RefreshCw className="w-3.5 h-3.5" />
+                    Actualiser
+                </button>
+            </div>
+
+            {loading ? (
+                <div className="animate-pulse space-y-4">
+                    {[1, 2, 3].map(i => <div key={i} className="h-24 bg-slate-900 rounded-xl" />)}
+                </div>
+            ) : (
+                <>
+                    {/* System health */}
+                    <div className="bg-slate-900 rounded-xl p-5 border border-slate-800">
+                        <h2 className="text-sm font-semibold text-white mb-4">Santé système</h2>
+                        <div className="grid grid-cols-3 gap-4">
+                            {[
+                                { label: 'Base de données', ok: health?.db?.ok },
+                                { label: 'Redis / Cache', ok: health?.redis?.ok },
+                                { label: 'Queue jobs', ok: (health?.queue?.failed ?? 0) === 0, detail: health?.queue?.failed > 0 ? `${health.queue.failed} échoués` : `${health?.queue?.waiting ?? 0} en attente` },
+                            ].map(({ label, ok, detail }) => (
+                                <div key={label} className={`p-4 rounded-lg border ${ok ? 'bg-emerald-950/30 border-emerald-900/50' : 'bg-red-950/30 border-red-900/50'}`}>
+                                    <div className="flex items-center gap-2 mb-1">
+                                        {ok ? <CheckCircle className="w-4 h-4 text-emerald-400" /> : <XCircle className="w-4 h-4 text-red-400" />}
+                                        <span className="text-sm font-medium text-white">{label}</span>
+                                    </div>
+                                    {detail && <div className="text-xs text-slate-400 ml-6">{detail}</div>}
+                                </div>
+                            ))}
+                        </div>
+                    </div>
+
+                    {/* Token expiry alerts */}
+                    <div className="bg-slate-900 rounded-xl p-5 border border-slate-800">
+                        <h2 className="text-sm font-semibold text-white mb-3 flex items-center gap-2">
+                            <AlertTriangle className="w-4 h-4 text-amber-400" />
+                            Tokens WhatsApp expirants
+                        </h2>
+                        {!health?.tokenExpiries?.length ? (
+                            <p className="text-sm text-slate-500">Aucun token en risque d'expiration</p>
+                        ) : (
+                            <div className="overflow-x-auto">
+                                <table className="w-full text-sm">
+                                    <thead>
+                                        <tr className="border-b border-slate-800">
+                                            <th className="text-left pb-2 text-xs font-medium text-slate-400">Organisation</th>
+                                            <th className="text-left pb-2 text-xs font-medium text-slate-400">Émis il y a</th>
+                                        </tr>
+                                    </thead>
+                                    <tbody className="divide-y divide-slate-800/50">
+                                        {health.tokenExpiries.map((t: any) => (
+                                            <tr key={t.orgId}>
+                                                <td className="py-2 text-white">{t.orgName}</td>
+                                                <td className={`py-2 text-sm font-medium ${(t.daysOld ?? 0) > 55 ? 'text-red-400' : 'text-amber-400'}`}>
+                                                    {t.daysOld ?? '?'} jours
+                                                </td>
+                                            </tr>
+                                        ))}
+                                    </tbody>
+                                </table>
+                            </div>
+                        )}
+                    </div>
+
+                    {/* Low balance alerts */}
+                    <div className="bg-slate-900 rounded-xl p-5 border border-slate-800">
+                        <h2 className="text-sm font-semibold text-white mb-3 flex items-center gap-2">
+                            <AlertTriangle className="w-4 h-4 text-red-400" />
+                            Soldes faibles (&lt; 100 crédits)
+                        </h2>
+                        {!health?.lowBalanceOrgs?.length ? (
+                            <p className="text-sm text-slate-500">Aucune organisation avec solde faible</p>
+                        ) : (
+                            <div className="space-y-2">
+                                {health.lowBalanceOrgs.map((o: any) => (
+                                    <div key={o.id} className="flex items-center justify-between bg-slate-800 rounded-lg px-3 py-2">
+                                        <span className="text-sm text-white">{o.name}</span>
+                                        <span className="text-sm font-medium text-red-400">{o.walletBalance} crédits</span>
+                                    </div>
+                                ))}
+                            </div>
+                        )}
+                    </div>
+                </>
+            )}
+        </div>
+    );
+}

apps/admin/src/pages/super-admin/OrganizationsManager.tsx

@@ -0,0 +1,278 @@
+import { useState, useEffect } from 'react';
+import { useAuth } from '@/lib/auth';
+import { api } from '@/lib/api';
+import { useToast } from '@/hooks/useToast';
+import { Search, Plus, Pencil, Ban, Check, X } from 'lucide-react';
+
+const PLAN_COLORS: Record<string, string> = {
+    STARTER: 'bg-slate-700 text-slate-300',
+    GROWTH: 'bg-blue-900/60 text-blue-300',
+    SCALE: 'bg-violet-900/60 text-violet-300',
+    ENTERPRISE: 'bg-amber-900/60 text-amber-300',
+};
+
+function StatusBadge({ isHardStopped, status }: { isHardStopped: boolean; status: string }) {
+    if (isHardStopped) return <span className="inline-flex items-center gap-1 text-xs px-2 py-0.5 rounded-full bg-red-900/60 text-red-300">Suspendu</span>;
+    if (status === 'TRIAL') return <span className="inline-flex items-center gap-1 text-xs px-2 py-0.5 rounded-full bg-amber-900/60 text-amber-300">Trial</span>;
+    return <span className="inline-flex items-center gap-1 text-xs px-2 py-0.5 rounded-full bg-emerald-900/60 text-emerald-300">Actif</span>;
+}
+
+export default function OrganizationsManager() {
+    const { token } = useAuth();
+    const toast = useToast();
+    const [orgs, setOrgs] = useState<any[]>([]);
+    const [total, setTotal] = useState(0);
+    const [page, setPage] = useState(1);
+    const [search, setSearch] = useState('');
+    const [loading, setLoading] = useState(true);
+    const [editOrg, setEditOrg] = useState<any>(null);
+    const [showCreate, setShowCreate] = useState(false);
+    const [newOrgName, setNewOrgName] = useState('');
+    const [saving, setSaving] = useState(false);
+
+    const LIMIT = 20;
+
+    async function load() {
+        if (!token) return;
+        setLoading(true);
+        try {
+            const params = new URLSearchParams({ page: String(page), limit: String(LIMIT) });
+            if (search) params.set('search', search);
+            const data = await api.get(`/v1/super-admin/organizations?${params}`, token);
+            setOrgs(data.data ?? []);
+            setTotal(data.total ?? 0);
+        } catch { toast.error('Erreur chargement organisations'); }
+        finally { setLoading(false); }
+    }
+
+    useEffect(() => { load(); }, [page, token]);
+
+    async function handleSearch(e: React.FormEvent) {
+        e.preventDefault();
+        setPage(1);
+        load();
+    }
+
+    async function handleSuspend(org: any) {
+        try {
+            await api.post(`/v1/super-admin/organizations/${org.id}/suspend`, { suspend: !org.isHardStopped }, token);
+            toast.success(org.isHardStopped ? 'Organisation réactivée' : 'Organisation suspendue');
+            load();
+        } catch { toast.error('Erreur modification statut'); }
+    }
+
+    async function handleSaveEdit() {
+        if (!editOrg) return;
+        setSaving(true);
+        try {
+            await api.patch(`/v1/super-admin/organizations/${editOrg.id}`, {
+                subscriptionPlan: editOrg.subscriptionPlan,
+                aiCreditsLimit: editOrg.aiCreditsLimit,
+                isCrmActive: editOrg.isCrmActive,
+                isEdTechActive: editOrg.isEdTechActive,
+            }, token);
+            toast.success('Organisation mise à jour');
+            setEditOrg(null);
+            load();
+        } catch { toast.error('Erreur mise à jour'); }
+        finally { setSaving(false); }
+    }
+
+    async function handleCreate() {
+        if (!newOrgName.trim()) return;
+        setSaving(true);
+        try {
+            await api.post('/v1/super-admin/organizations', { name: newOrgName }, token);
+            toast.success('Organisation créée');
+            setShowCreate(false);
+            setNewOrgName('');
+            load();
+        } catch { toast.error('Erreur création'); }
+        finally { setSaving(false); }
+    }
+
+    return (
+        <div className="space-y-4">
+            <div className="flex items-center justify-between">
+                <div>
+                    <h1 className="text-xl font-bold text-white">Organisations</h1>
+                    <p className="text-sm text-slate-400 mt-0.5">{total} organisations au total</p>
+                </div>
+                <button
+                    onClick={() => setShowCreate(true)}
+                    className="flex items-center gap-2 bg-violet-600 hover:bg-violet-500 text-white text-sm font-medium px-4 py-2 rounded-lg transition-colors"
+                >
+                    <Plus className="w-4 h-4" />
+                    Nouvelle organisation
+                </button>
+            </div>
+
+            {/* Search */}
+            <form onSubmit={handleSearch} className="flex gap-2">
+                <div className="relative flex-1">
+                    <Search className="absolute left-3 top-1/2 -translate-y-1/2 w-4 h-4 text-slate-400" />
+                    <input
+                        value={search}
+                        onChange={e => setSearch(e.target.value)}
+                        placeholder="Rechercher une organisation..."
+                        className="w-full pl-9 pr-4 py-2 bg-slate-900 border border-slate-700 rounded-lg text-sm text-white placeholder-slate-500 focus:outline-none focus:border-violet-500"
+                    />
+                </div>
+                <button type="submit" className="px-4 py-2 bg-slate-800 hover:bg-slate-700 text-white text-sm rounded-lg transition-colors">Rechercher</button>
+            </form>
+
+            {/* Table */}
+            <div className="bg-slate-900 rounded-xl border border-slate-800 overflow-hidden">
+                {loading ? (
+                    <div className="p-8 text-center text-slate-500 animate-pulse">Chargement...</div>
+                ) : orgs.length === 0 ? (
+                    <div className="p-8 text-center text-slate-500">Aucune organisation trouvée</div>
+                ) : (
+                    <div className="overflow-x-auto">
+                        <table className="w-full text-sm">
+                            <thead>
+                                <tr className="border-b border-slate-800">
+                                    <th className="text-left px-4 py-3 text-xs font-medium text-slate-400 uppercase tracking-wider">Nom</th>
+                                    <th className="text-left px-4 py-3 text-xs font-medium text-slate-400 uppercase tracking-wider">Plan</th>
+                                    <th className="text-left px-4 py-3 text-xs font-medium text-slate-400 uppercase tracking-wider">Statut</th>
+                                    <th className="text-right px-4 py-3 text-xs font-medium text-slate-400 uppercase tracking-wider">Utilisateurs</th>
+                                    <th className="text-right px-4 py-3 text-xs font-medium text-slate-400 uppercase tracking-wider">Crédits</th>
+                                    <th className="px-4 py-3" />
+                                </tr>
+                            </thead>
+                            <tbody className="divide-y divide-slate-800">
+                                {orgs.map(org => (
+                                    <tr key={org.id} className="hover:bg-slate-800/50 transition-colors">
+                                        <td className="px-4 py-3">
+                                            <div className="font-medium text-white">{org.name}</div>
+                                            <div className="text-xs text-slate-500 font-mono">{org.id.slice(0, 8)}…</div>
+                                        </td>
+                                        <td className="px-4 py-3">
+                                            <span className={`text-xs px-2 py-0.5 rounded-full ${PLAN_COLORS[org.subscriptionPlan] ?? 'bg-slate-700 text-slate-300'}`}>
+                                                {org.subscriptionPlan}
+                                            </span>
+                                        </td>
+                                        <td className="px-4 py-3">
+                                            <StatusBadge isHardStopped={org.isHardStopped} status={org.subscriptionStatus ?? 'ACTIVE'} />
+                                        </td>
+                                        <td className="px-4 py-3 text-right text-slate-300">{org.userCount}</td>
+                                        <td className="px-4 py-3 text-right text-slate-300">{org.walletBalance?.toLocaleString()}</td>
+                                        <td className="px-4 py-3">
+                                            <div className="flex items-center justify-end gap-1">
+                                                <button
+                                                    onClick={() => setEditOrg({ ...org })}
+                                                    className="p-1.5 text-slate-400 hover:text-white hover:bg-slate-700 rounded transition-colors"
+                                                    title="Modifier"
+                                                >
+                                                    <Pencil className="w-3.5 h-3.5" />
+                                                </button>
+                                                <button
+                                                    onClick={() => handleSuspend(org)}
+                                                    className={`p-1.5 rounded transition-colors ${org.isHardStopped ? 'text-emerald-400 hover:text-emerald-300 hover:bg-slate-700' : 'text-red-400 hover:text-red-300 hover:bg-slate-700'}`}
+                                                    title={org.isHardStopped ? 'Réactiver' : 'Suspendre'}
+                                                >
+                                                    {org.isHardStopped ? <Check className="w-3.5 h-3.5" /> : <Ban className="w-3.5 h-3.5" />}
+                                                </button>
+                                            </div>
+                                        </td>
+                                    </tr>
+                                ))}
+                            </tbody>
+                        </table>
+                    </div>
+                )}
+            </div>
+
+            {/* Pagination */}
+            {total > LIMIT && (
+                <div className="flex items-center justify-between text-sm text-slate-400">
+                    <span>{((page - 1) * LIMIT) + 1}–{Math.min(page * LIMIT, total)} sur {total}</span>
+                    <div className="flex gap-2">
+                        <button onClick={() => setPage(p => Math.max(1, p - 1))} disabled={page === 1} className="px-3 py-1.5 bg-slate-900 border border-slate-700 rounded-lg disabled:opacity-40 hover:bg-slate-800 transition-colors">Précédent</button>
+                        <button onClick={() => setPage(p => p + 1)} disabled={page * LIMIT >= total} className="px-3 py-1.5 bg-slate-900 border border-slate-700 rounded-lg disabled:opacity-40 hover:bg-slate-800 transition-colors">Suivant</button>
+                    </div>
+                </div>
+            )}
+
+            {/* Edit drawer */}
+            {editOrg && (
+                <div className="fixed inset-0 bg-black/60 z-50 flex justify-end">
+                    <div className="w-96 bg-slate-900 border-l border-slate-800 h-full overflow-y-auto p-6 space-y-5">
+                        <div className="flex items-center justify-between">
+                            <h2 className="text-base font-bold text-white">{editOrg.name}</h2>
+                            <button onClick={() => setEditOrg(null)} className="p-1.5 text-slate-400 hover:text-white"><X className="w-4 h-4" /></button>
+                        </div>
+                        <div className="space-y-4">
+                            <div>
+                                <label className="text-xs font-medium text-slate-400 uppercase tracking-wider">Plan</label>
+                                <select
+                                    value={editOrg.subscriptionPlan}
+                                    onChange={e => setEditOrg({ ...editOrg, subscriptionPlan: e.target.value })}
+                                    className="mt-1.5 w-full bg-slate-800 border border-slate-700 rounded-lg px-3 py-2 text-sm text-white focus:outline-none focus:border-violet-500"
+                                >
+                                    {['STARTER', 'GROWTH', 'SCALE', 'ENTERPRISE'].map(p => <option key={p} value={p}>{p}</option>)}
+                                </select>
+                            </div>
+                            <div>
+                                <label className="text-xs font-medium text-slate-400 uppercase tracking-wider">Limite crédits AI</label>
+                                <input
+                                    type="number"
+                                    value={editOrg.aiCreditsLimit}
+                                    onChange={e => setEditOrg({ ...editOrg, aiCreditsLimit: parseInt(e.target.value) })}
+                                    className="mt-1.5 w-full bg-slate-800 border border-slate-700 rounded-lg px-3 py-2 text-sm text-white focus:outline-none focus:border-violet-500"
+                                />
+                            </div>
+                            <div className="flex items-center justify-between">
+                                <span className="text-sm text-slate-300">CRM actif</span>
+                                <button
+                                    onClick={() => setEditOrg({ ...editOrg, isCrmActive: !editOrg.isCrmActive })}
+                                    className={`w-10 h-5 rounded-full transition-colors relative ${editOrg.isCrmActive ? 'bg-violet-600' : 'bg-slate-700'}`}
+                                >
+                                    <span className={`absolute top-0.5 w-4 h-4 bg-white rounded-full transition-all ${editOrg.isCrmActive ? 'left-5' : 'left-0.5'}`} />
+                                </button>
+                            </div>
+                            <div className="flex items-center justify-between">
+                                <span className="text-sm text-slate-300">EdTech actif</span>
+                                <button
+                                    onClick={() => setEditOrg({ ...editOrg, isEdTechActive: !editOrg.isEdTechActive })}
+                                    className={`w-10 h-5 rounded-full transition-colors relative ${editOrg.isEdTechActive ? 'bg-violet-600' : 'bg-slate-700'}`}
+                                >
+                                    <span className={`absolute top-0.5 w-4 h-4 bg-white rounded-full transition-all ${editOrg.isEdTechActive ? 'left-5' : 'left-0.5'}`} />
+                                </button>
+                            </div>
+                        </div>
+                        <button
+                            onClick={handleSaveEdit}
+                            disabled={saving}
+                            className="w-full bg-violet-600 hover:bg-violet-500 disabled:opacity-50 text-white font-medium py-2 rounded-lg text-sm transition-colors"
+                        >
+                            {saving ? 'Sauvegarde...' : 'Sauvegarder'}
+                        </button>
+                    </div>
+                </div>
+            )}
+
+            {/* Create modal */}
+            {showCreate && (
+                <div className="fixed inset-0 bg-black/60 z-50 flex items-center justify-center">
+                    <div className="bg-slate-900 border border-slate-800 rounded-xl p-6 w-96 space-y-4">
+                        <h2 className="text-base font-bold text-white">Nouvelle organisation</h2>
+                        <input
+                            autoFocus
+                            value={newOrgName}
+                            onChange={e => setNewOrgName(e.target.value)}
+                            placeholder="Nom de l'organisation"
+                            className="w-full bg-slate-800 border border-slate-700 rounded-lg px-3 py-2 text-sm text-white placeholder-slate-500 focus:outline-none focus:border-violet-500"
+                        />
+                        <div className="flex gap-2">
+                            <button onClick={() => setShowCreate(false)} className="flex-1 py-2 bg-slate-800 hover:bg-slate-700 text-slate-300 text-sm rounded-lg transition-colors">Annuler</button>
+                            <button onClick={handleCreate} disabled={saving || !newOrgName.trim()} className="flex-1 py-2 bg-violet-600 hover:bg-violet-500 disabled:opacity-50 text-white text-sm font-medium rounded-lg transition-colors">
+                                {saving ? 'Création...' : 'Créer'}
+                            </button>
+                        </div>
+                    </div>
+                </div>
+            )}
+        </div>
+    );
+}

apps/admin/src/pages/super-admin/PlatformDashboard.tsx

@@ -0,0 +1,118 @@
+import { useState, useEffect } from 'react';
+import { useAuth } from '@/lib/auth';
+import { api } from '@/lib/api';
+import { Building2, Users, MessageSquare, Layers, AlertTriangle, TrendingUp } from 'lucide-react';
+
+interface Stats {
+    orgsCount: number;
+    activeOrgs: number;
+    usersCount: number;
+    messagesLast24h: number;
+    queueDepth: number;
+    queueFailed: number;
+    revenueThisMonth: number;
+    tokenExpiries?: any[];
+    lowBalanceOrgs?: any[];
+}
+
+function KPICard({ title, value, icon: Icon, color, sub }: { title: string; value: any; icon: any; color: string; sub?: string }) {
+    return (
+        <div className="bg-slate-900 rounded-xl p-5 border border-slate-800">
+            <div className="flex items-start justify-between">
+                <div>
+                    <p className="text-xs font-medium text-slate-400 uppercase tracking-wider">{title}</p>
+                    <p className="text-2xl font-bold text-white mt-1">{value?.toLocaleString() ?? '—'}</p>
+                    {sub && <p className="text-xs text-slate-500 mt-0.5">{sub}</p>}
+                </div>
+                <div className={`p-2.5 rounded-lg ${color}`}>
+                    <Icon className="w-4 h-4 text-white" />
+                </div>
+            </div>
+        </div>
+    );
+}
+
+export default function PlatformDashboard() {
+    const { token } = useAuth();
+    const [stats, setStats] = useState<Stats | null>(null);
+    const [health, setHealth] = useState<any>(null);
+    const [loading, setLoading] = useState(true);
+
+    useEffect(() => {
+        if (!token) return;
+        Promise.all([
+            api.get('/v1/super-admin/platform/stats', token),
+            api.get('/v1/super-admin/monitoring/health', token),
+        ])
+            .then(([s, h]) => { setStats(s); setHealth(h); })
+            .finally(() => setLoading(false));
+    }, [token]);
+
+    if (loading) return (
+        <div className="space-y-4 animate-pulse">
+            <div className="grid grid-cols-2 lg:grid-cols-4 gap-4">
+                {[...Array(6)].map((_, i) => <div key={i} className="h-28 bg-slate-900 rounded-xl" />)}
+            </div>
+        </div>
+    );
+
+    const alerts = [
+        ...(health?.tokenExpiries?.map((t: any) => ({ type: 'token', msg: `Token expirant — ${t.orgName} (${t.daysOld}j)` })) ?? []),
+        ...(health?.lowBalanceOrgs?.map((o: any) => ({ type: 'balance', msg: `Solde faible — ${o.orgName}: ${o.walletBalance} crédits` })) ?? []),
+        ...(health?.queue?.failed > 0 ? [{ type: 'queue', msg: `${health.queue.failed} jobs échoués en queue` }] : []),
+    ];
+
+    return (
+        <div className="space-y-6">
+            <div>
+                <h1 className="text-xl font-bold text-white">Platform Dashboard</h1>
+                <p className="text-sm text-slate-400 mt-0.5">Vue globale de toutes les organisations</p>
+            </div>
+
+            <div className="grid grid-cols-2 lg:grid-cols-3 gap-4">
+                <KPICard title="Organisations" value={stats?.orgsCount} icon={Building2} color="bg-violet-600" sub={`${stats?.activeOrgs ?? 0} actives`} />
+                <KPICard title="Utilisateurs" value={stats?.usersCount} icon={Users} color="bg-blue-600" />
+                <KPICard title="Messages / 24h" value={stats?.messagesLast24h} icon={MessageSquare} color="bg-emerald-600" />
+                <KPICard title="Queue depth" value={stats?.queueDepth} icon={Layers} color={(stats?.queueDepth ?? 0) > 50 ? 'bg-amber-600' : 'bg-slate-700'} sub={stats?.queueFailed ? `${stats.queueFailed} échoués` : undefined} />
+                <KPICard title="Revenus / mois" value={`${(stats?.revenueThisMonth ?? 0).toLocaleString()} cr.`} icon={TrendingUp} color="bg-pink-600" />
+                <KPICard title="Alertes" value={alerts.length} icon={AlertTriangle} color={alerts.length > 0 ? 'bg-red-600' : 'bg-slate-700'} />
+            </div>
+
+            {/* System health */}
+            <div className="bg-slate-900 rounded-xl p-5 border border-slate-800">
+                <h2 className="text-sm font-semibold text-white mb-3">Santé système</h2>
+                <div className="flex flex-wrap gap-3">
+                    {[
+                        { label: 'Base de données', ok: health?.db?.ok },
+                        { label: 'Redis', ok: health?.redis?.ok },
+                        { label: 'Queue', ok: (health?.queue?.failed ?? 0) === 0 },
+                    ].map(({ label, ok }) => (
+                        <div key={label} className="flex items-center gap-2 bg-slate-800 rounded-lg px-3 py-2">
+                            <div className={`w-2 h-2 rounded-full ${ok ? 'bg-green-400' : 'bg-red-400'}`} />
+                            <span className="text-xs text-slate-300">{label}</span>
+                            <span className={`text-xs font-medium ${ok ? 'text-green-400' : 'text-red-400'}`}>{ok ? 'OK' : 'KO'}</span>
+                        </div>
+                    ))}
+                </div>
+            </div>
+
+            {/* Alerts */}
+            {alerts.length > 0 && (
+                <div className="bg-slate-900 rounded-xl p-5 border border-red-900/50">
+                    <h2 className="text-sm font-semibold text-red-400 mb-3 flex items-center gap-2">
+                        <AlertTriangle className="w-4 h-4" />
+                        Alertes actives ({alerts.length})
+                    </h2>
+                    <div className="space-y-2">
+                        {alerts.map((a, i) => (
+                            <div key={i} className="flex items-center gap-2 text-sm text-slate-300 bg-slate-800 rounded-lg px-3 py-2">
+                                <div className="w-1.5 h-1.5 rounded-full bg-red-400 shrink-0" />
+                                {a.msg}
+                            </div>
+                        ))}
+                    </div>
+                </div>
+            )}
+        </div>
+    );
+}

apps/admin/src/pages/super-admin/SuperAdminLayout.tsx

@@ -0,0 +1,97 @@
+import { Outlet, NavLink, useNavigate } from 'react-router-dom';
+import { useAuth } from '@/lib/auth';
+import { useTenant } from '@/lib/tenant';
+import {
+    LayoutDashboard, Building2, Users, Phone, Activity,
+    CreditCard, Bot, LogOut, ChevronLeft
+} from 'lucide-react';
+
+const NAV_ITEMS = [
+    { to: '/platform/dashboard', icon: LayoutDashboard, label: 'Dashboard' },
+    { to: '/platform/organizations', icon: Building2, label: 'Organisations' },
+    { to: '/platform/users', icon: Users, label: 'Utilisateurs' },
+    { to: '/platform/whatsapp', icon: Phone, label: 'WhatsApp' },
+    { to: '/platform/monitoring', icon: Activity, label: 'Monitoring' },
+    { to: '/platform/billing', icon: CreditCard, label: 'Billing' },
+    { to: '/platform/ai', icon: Bot, label: 'AI Insights' },
+];
+
+export default function SuperAdminLayout() {
+    const { user, logout } = useAuth();
+    const { setSelectedOrgId } = useTenant();
+    const navigate = useNavigate();
+
+    function handleExit() {
+        setSelectedOrgId(null);
+        navigate('/');
+    }
+
+    return (
+        <div className="flex h-screen bg-slate-950 text-white overflow-hidden">
+            {/* Sidebar */}
+            <aside className="w-60 shrink-0 bg-slate-900 border-r border-slate-800 flex flex-col">
+                <div className="px-4 py-5 border-b border-slate-800">
+                    <div className="text-xs font-semibold text-violet-400 uppercase tracking-widest mb-0.5">XAMLÉ</div>
+                    <div className="text-base font-bold text-white">Platform Admin</div>
+                </div>
+
+                <nav className="flex-1 overflow-y-auto py-3 px-2 space-y-0.5">
+                    {NAV_ITEMS.map(({ to, icon: Icon, label }) => (
+                        <NavLink
+                            key={to}
+                            to={to}
+                            className={({ isActive }) =>
+                                `flex items-center gap-3 px-3 py-2 rounded-lg text-sm font-medium transition-colors ${
+                                    isActive
+                                        ? 'bg-violet-600 text-white'
+                                        : 'text-slate-400 hover:text-white hover:bg-slate-800'
+                                }`
+                            }
+                        >
+                            <Icon className="w-4 h-4 shrink-0" />
+                            {label}
+                        </NavLink>
+                    ))}
+                </nav>
+
+                <div className="p-3 border-t border-slate-800 space-y-1">
+                    <button
+                        onClick={handleExit}
+                        className="flex items-center gap-3 w-full px-3 py-2 rounded-lg text-sm text-slate-400 hover:text-white hover:bg-slate-800 transition-colors"
+                    >
+                        <ChevronLeft className="w-4 h-4" />
+                        Quitter l'admin
+                    </button>
+                    <button
+                        onClick={logout}
+                        className="flex items-center gap-3 w-full px-3 py-2 rounded-lg text-sm text-red-400 hover:text-red-300 hover:bg-slate-800 transition-colors"
+                    >
+                        <LogOut className="w-4 h-4" />
+                        Déconnexion
+                    </button>
+                </div>
+            </aside>
+
+            {/* Main */}
+            <div className="flex-1 flex flex-col min-w-0 overflow-hidden">
+                {/* Top bar */}
+                <header className="h-14 shrink-0 bg-slate-900 border-b border-slate-800 flex items-center justify-between px-6">
+                    <div className="text-sm text-slate-400">
+                        Super-admin · <span className="text-white">{user?.email || user?.name || 'Admin'}</span>
+                    </div>
+                    <div className="flex items-center gap-2">
+                        <div className="w-2 h-2 rounded-full bg-green-400 animate-pulse" />
+                        <span className="text-xs text-slate-400">Système actif</span>
+                    </div>
+                </header>
+
+                {/* Page content */}
+                <main className="flex-1 overflow-y-auto bg-slate-950">
+                    <div className="p-6 max-w-screen-xl mx-auto">
+                        <Outlet />
+                    </div>
+                </main>
+            </div>
+        </div>
+    );
+}

apps/admin/src/pages/super-admin/SuperAdminRouter.tsx

@@ -0,0 +1,27 @@
+import { Routes, Route, Navigate } from 'react-router-dom';
+import SuperAdminLayout from './SuperAdminLayout';
+import PlatformDashboard from './PlatformDashboard';
+import OrganizationsManager from './OrganizationsManager';
+import UsersManager from './UsersManager';
+import WhatsAppNumbers from './WhatsAppNumbers';
+import MonitoringAlerts from './MonitoringAlerts';
+import BillingManager from './BillingManager';
+import AIInsights from './AIInsights';
+
+export default function SuperAdminRouter() {
+    return (
+        <Routes>
+            <Route path="/*" element={<SuperAdminLayout />}>
+                <Route index element={<Navigate to="/platform/dashboard" replace />} />
+                <Route path="platform/dashboard" element={<PlatformDashboard />} />
+                <Route path="platform/organizations" element={<OrganizationsManager />} />
+                <Route path="platform/users" element={<UsersManager />} />
+                <Route path="platform/whatsapp" element={<WhatsAppNumbers />} />
+                <Route path="platform/monitoring" element={<MonitoringAlerts />} />
+                <Route path="platform/billing" element={<BillingManager />} />
+                <Route path="platform/ai" element={<AIInsights />} />
+                <Route path="*" element={<Navigate to="/platform/dashboard" replace />} />
+            </Route>
+        </Routes>
+    );
+}

apps/admin/src/pages/super-admin/UsersManager.tsx

@@ -0,0 +1,132 @@
+import { useState, useEffect } from 'react';
+import { useAuth } from '@/lib/auth';
+import { api } from '@/lib/api';
+import { useToast } from '@/hooks/useToast';
+import { Search } from 'lucide-react';
+
+const ROLE_COLORS: Record<string, string> = {
+    STUDENT: 'bg-slate-700 text-slate-300',
+    ORG_MEMBER: 'bg-blue-900/60 text-blue-300',
+    ORG_ADMIN: 'bg-violet-900/60 text-violet-300',
+    ADMIN: 'bg-amber-900/60 text-amber-300',
+    SUPER_ADMIN: 'bg-red-900/60 text-red-300',
+};
+
+export default function UsersManager() {
+    const { token } = useAuth();
+    const toast = useToast();
+    const [users, setUsers] = useState<any[]>([]);
+    const [total, setTotal] = useState(0);
+    const [page, setPage] = useState(1);
+    const [search, setSearch] = useState('');
+    const [loading, setLoading] = useState(true);
+
+    const LIMIT = 20;
+
+    async function load() {
+        if (!token) return;
+        setLoading(true);
+        try {
+            const params = new URLSearchParams({ page: String(page), limit: String(LIMIT) });
+            if (search) params.set('search', search);
+            const data = await api.get(`/v1/super-admin/users?${params}`, token);
+            setUsers(data.data ?? []);
+            setTotal(data.total ?? 0);
+        } catch { toast.error('Erreur chargement utilisateurs'); }
+        finally { setLoading(false); }
+    }
+
+    useEffect(() => { load(); }, [page, token]);
+
+    async function handleSearch(e: React.FormEvent) {
+        e.preventDefault();
+        setPage(1);
+        load();
+    }
+
+    async function handleRoleChange(userId: string, role: string) {
+        try {
+            await api.patch(`/v1/super-admin/users/${userId}/role`, { role }, token);
+            toast.success('Rôle mis à jour');
+            load();
+        } catch { toast.error('Erreur changement de rôle'); }
+    }
+
+    return (
+        <div className="space-y-4">
+            <div>
+                <h1 className="text-xl font-bold text-white">Utilisateurs</h1>
+                <p className="text-sm text-slate-400 mt-0.5">{total} utilisateurs au total</p>
+            </div>
+
+            <form onSubmit={handleSearch} className="flex gap-2">
+                <div className="relative flex-1">
+                    <Search className="absolute left-3 top-1/2 -translate-y-1/2 w-4 h-4 text-slate-400" />
+                    <input
+                        value={search}
+                        onChange={e => setSearch(e.target.value)}
+                        placeholder="Rechercher par nom ou email..."
+                        className="w-full pl-9 pr-4 py-2 bg-slate-900 border border-slate-700 rounded-lg text-sm text-white placeholder-slate-500 focus:outline-none focus:border-violet-500"
+                    />
+                </div>
+                <button type="submit" className="px-4 py-2 bg-slate-800 hover:bg-slate-700 text-white text-sm rounded-lg transition-colors">Rechercher</button>
+            </form>
+
+            <div className="bg-slate-900 rounded-xl border border-slate-800 overflow-hidden">
+                {loading ? (
+                    <div className="p-8 text-center text-slate-500 animate-pulse">Chargement...</div>
+                ) : users.length === 0 ? (
+                    <div className="p-8 text-center text-slate-500">Aucun utilisateur trouvé</div>
+                ) : (
+                    <div className="overflow-x-auto">
+                        <table className="w-full text-sm">
+                            <thead>
+                                <tr className="border-b border-slate-800">
+                                    <th className="text-left px-4 py-3 text-xs font-medium text-slate-400 uppercase tracking-wider">Utilisateur</th>
+                                    <th className="text-left px-4 py-3 text-xs font-medium text-slate-400 uppercase tracking-wider">Organisation</th>
+                                    <th className="text-left px-4 py-3 text-xs font-medium text-slate-400 uppercase tracking-wider">Rôle</th>
+                                    <th className="text-left px-4 py-3 text-xs font-medium text-slate-400 uppercase tracking-wider">Créé le</th>
+                                    <th className="px-4 py-3" />
+                                </tr>
+                            </thead>
+                            <tbody className="divide-y divide-slate-800">
+                                {users.map(user => (
+                                    <tr key={user.id} className="hover:bg-slate-800/50 transition-colors">
+                                        <td className="px-4 py-3">
+                                            <div className="font-medium text-white">{user.name || '—'}</div>
+                                            <div className="text-xs text-slate-500">{user.email || user.phone || '—'}</div>
+                                        </td>
+                                        <td className="px-4 py-3 text-slate-300 text-xs">{user.organization?.name || '—'}</td>
+                                        <td className="px-4 py-3">
+                                            <span className={`text-xs px-2 py-0.5 rounded-full ${ROLE_COLORS[user.role] ?? 'bg-slate-700 text-slate-300'}`}>{user.role}</span>
+                                        </td>
+                                        <td className="px-4 py-3 text-xs text-slate-400">{new Date(user.createdAt).toLocaleDateString('fr-FR')}</td>
+                                        <td className="px-4 py-3">
+                                            <select
+                                                defaultValue={user.role}
+                                                onChange={e => handleRoleChange(user.id, e.target.value)}
+                                                className="text-xs bg-slate-800 border border-slate-700 rounded px-2 py-1 text-slate-300 focus:outline-none focus:border-violet-500"
+                                            >
+                                                {['STUDENT', 'ORG_MEMBER', 'ORG_ADMIN', 'ADMIN', 'SUPER_ADMIN'].map(r => <option key={r} value={r}>{r}</option>)}
+                                            </select>
+                                        </td>
+                                    </tr>
+                                ))}
+                            </tbody>
+                        </table>
+                    </div>
+                )}
+            </div>
+
+            {total > LIMIT && (
+                <div className="flex items-center justify-between text-sm text-slate-400">
+                    <span>{((page - 1) * LIMIT) + 1}–{Math.min(page * LIMIT, total)} sur {total}</span>
+                    <div className="flex gap-2">
+                        <button onClick={() => setPage(p => Math.max(1, p - 1))} disabled={page === 1} className="px-3 py-1.5 bg-slate-900 border border-slate-700 rounded-lg disabled:opacity-40 hover:bg-slate-800 transition-colors">Précédent</button>
+                        <button onClick={() => setPage(p => p + 1)} disabled={page * LIMIT >= total} className="px-3 py-1.5 bg-slate-900 border border-slate-700 rounded-lg disabled:opacity-40 hover:bg-slate-800 transition-colors">Suivant</button>
+                    </div>
+                </div>
+            )}
+        </div>
+    );
+}

apps/admin/src/pages/super-admin/WhatsAppNumbers.tsx

@@ -0,0 +1,73 @@
+import { useState, useEffect } from 'react';
+import { useAuth } from '@/lib/auth';
+import { api } from '@/lib/api';
+import { useToast } from '@/hooks/useToast';
+import { Phone, RefreshCw } from 'lucide-react';
+
+export default function WhatsAppNumbers() {
+    const { token } = useAuth();
+    const toast = useToast();
+    const [numbers, setNumbers] = useState<any[]>([]);
+    const [loading, setLoading] = useState(true);
+
+    async function load() {
+        if (!token) return;
+        setLoading(true);
+        try {
+            const data = await api.get('/v1/super-admin/whatsapp/numbers', token);
+            setNumbers(data.data ?? []);
+        } catch { toast.error('Erreur chargement numéros'); }
+        finally { setLoading(false); }
+    }
+
+    useEffect(() => { load(); }, [token]);
+
+    return (
+        <div className="space-y-4">
+            <div className="flex items-center justify-between">
+                <div>
+                    <h1 className="text-xl font-bold text-white">Numéros WhatsApp</h1>
+                    <p className="text-sm text-slate-400 mt-0.5">{numbers.length} numéros enregistrés</p>
+                </div>
+                <button onClick={load} className="flex items-center gap-2 px-3 py-2 bg-slate-800 hover:bg-slate-700 text-slate-300 text-sm rounded-lg transition-colors">
+                    <RefreshCw className="w-3.5 h-3.5" />
+                    Actualiser
+                </button>
+            </div>
+
+            <div className="bg-slate-900 rounded-xl border border-slate-800 overflow-hidden">
+                {loading ? (
+                    <div className="p-8 text-center text-slate-500 animate-pulse">Chargement...</div>
+                ) : numbers.length === 0 ? (
+                    <div className="p-12 flex flex-col items-center gap-3 text-slate-500">
+                        <Phone className="w-8 h-8" />
+                        <p>Aucun numéro WhatsApp enregistré</p>
+                    </div>
+                ) : (
+                    <div className="overflow-x-auto">
+                        <table className="w-full text-sm">
+                            <thead>
+                                <tr className="border-b border-slate-800">
+                                    <th className="text-left px-4 py-3 text-xs font-medium text-slate-400 uppercase tracking-wider">Numéro</th>
+                                    <th className="text-left px-4 py-3 text-xs font-medium text-slate-400 uppercase tracking-wider">Organisation</th>
+                                    <th className="text-left px-4 py-3 text-xs font-medium text-slate-400 uppercase tracking-wider">ID</th>
+                                    <th className="text-left px-4 py-3 text-xs font-medium text-slate-400 uppercase tracking-wider">Ajouté le</th>
+                                </tr>
+                            </thead>
+                            <tbody className="divide-y divide-slate-800">
+                                {numbers.map(n => (
+                                    <tr key={n.id} className="hover:bg-slate-800/50 transition-colors">
+                                        <td className="px-4 py-3 font-medium text-white">{n.displayPhone}</td>
+                                        <td className="px-4 py-3 text-slate-300">{n.organization?.name || '—'}</td>
+                                        <td className="px-4 py-3 text-xs font-mono text-slate-500">{n.id}</td>
+                                        <td className="px-4 py-3 text-xs text-slate-400">{new Date(n.createdAt).toLocaleDateString('fr-FR')}</td>
+                                    </tr>
+                                ))}
+                            </tbody>
+                        </table>
+                    </div>
+                )}
+            </div>
+        </div>
+    );
+}

apps/api/src/app.ts

@@ -17,6 +17,7 @@ import { notificationRoutes } from './routes/notifications';
 import { authRoutes } from './routes/auth';
 import campaignRoutes from './routes/campaigns';
 import { internalRoutes } from './routes/internal';
+import { superAdminRoutes } from './routes/super-admin';
 import { setupErrorHandler } from './utils/errors';
 import { injectTenantConfig } from './middleware/tenant';
 import { validateApiKey } from './middleware/validateApiKey';
@@ -47,7 +48,10 @@ export async function buildApp() {
     });
 
     await server.register(jwt, {
-        secret: process.env.JWT_SECRET || 'super-secret-dev-key'
+        secret: (() => {
+            if (!process.env.JWT_SECRET) throw new Error('JWT_SECRET env var is required');
+            return process.env.JWT_SECRET;
+        })()
     });
 
     await server.register(rateLimit, {
@@ -91,6 +95,7 @@ export async function buildApp() {
         scope.register(billingRoutes, { prefix: '/v1/billing' });
         scope.register(notificationRoutes, { prefix: '/v1/notifications' });
         scope.register(campaignRoutes, { prefix: '/v1/organizations' });
+        scope.register(superAdminRoutes, { prefix: '/v1/super-admin' });
     });
 
     server.register(whatsappRoutes, { prefix: '/v1/whatsapp' });

apps/api/src/routes/admin.ts

@@ -56,6 +56,13 @@ const PaginationSchema = z.object({
 
 export async function adminRoutes(fastify: FastifyInstance) {
 
+    fastify.addHook('preHandler', async (request, reply) => {
+        const role = (request as any).user?.role;
+        if (!role || !['ORG_ADMIN', 'ADMIN', 'SUPER_ADMIN'].includes(role)) {
+            return reply.code(403).send({ error: 'Admin access required' });
+        }
+    });
+
     // ── Dashboard Stats ────────────────────────────────────────────────────────
     fastify.get('/stats', async (req, reply) => {
         const organizationId = req.organizationId;

apps/api/src/routes/analytics.ts

@@ -241,12 +241,17 @@ Règles IMPÉRATIVES:
             return reply.code(503).send({ error: 'AI service unavailable' });
         }
 
-        // Safety: only allow SELECT — reject anything else
+        // Safety: only allow simple SELECT — reject dangerous patterns
         const normalized = sql.replace(/\s+/g, ' ').trim().toUpperCase();
         if (!normalized.startsWith('SELECT')) {
             logger.warn({ sql }, '[TEXT-SQL] Non-SELECT query rejected');
             return reply.code(400).send({ error: 'Only SELECT queries are allowed', generatedSql: sql });
         }
+        const DANGEROUS_PATTERNS = [/\bUNION\b/, /\bINSERT\b/, /\bUPDATE\b/, /\bDELETE\b/, /\bDROP\b/, /\bEXEC\b/, /\bEXECUTE\b/, /--/, /\/\*/, /;\s*SELECT/i];
+        if (DANGEROUS_PATTERNS.some(p => p.test(normalized))) {
+            logger.warn({ sql }, '[TEXT-SQL] Dangerous pattern detected — query rejected');
+            return reply.code(400).send({ error: 'Query contains disallowed patterns' });
+        }
 
         // Inject correct organizationId (replace placeholder used by LLM)
         const safeSql = sql

apps/api/src/routes/super-admin.ts

@@ -0,0 +1,528 @@
+import { FastifyInstance } from 'fastify';
+import { prisma } from '../services/prisma';
+import { logger } from '../logger';
+import { z } from 'zod';
+import { redis } from '../lib/redis';
+import { whatsappQueue } from '../services/queue';
+
+export async function superAdminRoutes(fastify: FastifyInstance) {
+
+    fastify.addHook('preHandler', async (request: any, reply) => {
+        const role = request.user?.role;
+        if (role !== 'SUPER_ADMIN' && role !== 'ADMIN') {
+            return reply.code(403).send({ error: 'Super admin access required' });
+        }
+    });
+
+    // ── Platform Stats ────────────────────────────────────────────────────────
+    fastify.get('/platform/stats', async (_req, reply) => {
+        try {
+            const since24h = new Date(Date.now() - 24 * 60 * 60 * 1000);
+            const since30d = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000);
+
+            const [orgsCount, usersCount, messagesLast24h, revenueAgg, queueCounts] = await Promise.all([
+                prisma.organization.count(),
+                prisma.user.count({ where: { deletedAt: null } }),
+                prisma.message.count({ where: { createdAt: { gte: since24h } } }),
+                prisma.walletTransaction.aggregate({
+                    where: { type: 'TOP_UP_MANUAL', createdAt: { gte: since30d } },
+                    _sum: { amount: true }
+                }),
+                Promise.all([
+                    whatsappQueue.getWaitingCount(),
+                    whatsappQueue.getFailedCount(),
+                    whatsappQueue.getActiveCount(),
+                ]).catch(() => [0, 0, 0]),
+            ]);
+
+            const activeOrgs = await prisma.organization.count({
+                where: { isHardStopped: false }
+            });
+
+            return {
+                orgsCount,
+                activeOrgs,
+                usersCount,
+                messagesLast24h,
+                queueDepth: Array.isArray(queueCounts) ? (queueCounts[0] + queueCounts[2]) : 0,
+                queueFailed: Array.isArray(queueCounts) ? queueCounts[1] : 0,
+                revenueThisMonth: revenueAgg._sum.amount ?? 0,
+            };
+        } catch (err) {
+            logger.error({ err }, '[SUPER_ADMIN] platform/stats failed');
+            return reply.code(500).send({ error: 'Failed to fetch platform stats' });
+        }
+    });
+
+    // ── Organizations ─────────────────────────────────────────────────────────
+    fastify.get('/organizations', async (req, reply) => {
+        const QuerySchema = z.object({
+            page: z.coerce.number().int().positive().default(1),
+            limit: z.coerce.number().int().positive().max(100).default(20),
+            search: z.string().optional(),
+            plan: z.string().optional(),
+        });
+        const parsed = QuerySchema.safeParse(req.query);
+        if (!parsed.success) return reply.code(400).send({ error: 'Invalid query params' });
+
+        const { page, limit, search, plan } = parsed.data;
+        const where: any = {};
+        if (search) where.name = { contains: search, mode: 'insensitive' };
+        if (plan) where.subscriptionPlan = plan;
+
+        try {
+            const [orgs, total] = await Promise.all([
+                prisma.organization.findMany({
+                    where,
+                    select: {
+                        id: true, name: true, wabaId: true, walletBalance: true,
+                        subscriptionPlan: true, subscriptionStatus: true, isHardStopped: true,
+                        createdAt: true, mode: true, isCrmActive: true, isEdTechActive: true,
+                        _count: { select: { users: true } }
+                    },
+                    orderBy: { createdAt: 'desc' },
+                    skip: (page - 1) * limit,
+                    take: limit,
+                }),
+                prisma.organization.count({ where }),
+            ]);
+            return { data: orgs.map(o => ({ ...o, userCount: o._count.users })), total, page, limit };
+        } catch (err) {
+            logger.error({ err }, '[SUPER_ADMIN] organizations list failed');
+            return reply.code(500).send({ error: 'Failed to list organizations' });
+        }
+    });
+
+    fastify.post('/organizations', async (req, reply) => {
+        const Schema = z.object({
+            name: z.string().min(1),
+            subscriptionPlan: z.enum(['STARTER', 'GROWTH', 'SCALE', 'ENTERPRISE']).default('STARTER'),
+            aiCreditsLimit: z.number().int().positive().default(500),
+            isCrmActive: z.boolean().default(false),
+            isEdTechActive: z.boolean().default(true),
+        });
+        const body = Schema.safeParse(req.body);
+        if (!body.success) return reply.code(400).send({ error: body.error.flatten() });
+
+        try {
+            const org = await prisma.organization.create({ data: body.data });
+            return reply.code(201).send(org);
+        } catch (err: any) {
+            logger.error({ err }, '[SUPER_ADMIN] org create failed');
+            return reply.code(500).send({ error: 'Failed to create organization' });
+        }
+    });
+
+    fastify.patch<{ Params: { id: string } }>('/organizations/:id', async (req, reply) => {
+        const Schema = z.object({
+            name: z.string().min(1).optional(),
+            subscriptionPlan: z.enum(['STARTER', 'GROWTH', 'SCALE', 'ENTERPRISE']).optional(),
+            subscriptionStatus: z.string().optional(),
+            aiCreditsLimit: z.number().int().positive().optional(),
+            isHardStopped: z.boolean().optional(),
+            isCrmActive: z.boolean().optional(),
+            isEdTechActive: z.boolean().optional(),
+            walletBalance: z.number().int().optional(),
+        });
+        const body = Schema.safeParse(req.body);
+        if (!body.success) return reply.code(400).send({ error: body.error.flatten() });
+
+        try {
+            const org = await prisma.organization.update({
+                where: { id: req.params.id },
+                data: body.data,
+            });
+            return org;
+        } catch (err: any) {
+            logger.error({ err, orgId: req.params.id }, '[SUPER_ADMIN] org update failed');
+            if (err.code === 'P2025') return reply.code(404).send({ error: 'Organization not found' });
+            return reply.code(500).send({ error: 'Failed to update organization' });
+        }
+    });
+
+    // Suspend / activate shortcut
+    fastify.post<{ Params: { id: string } }>('/organizations/:id/suspend', async (req, reply) => {
+        const Schema = z.object({ suspend: z.boolean() });
+        const body = Schema.safeParse(req.body);
+        if (!body.success) return reply.code(400).send({ error: body.error.flatten() });
+        try {
+            await prisma.organization.update({
+                where: { id: req.params.id },
+                data: { isHardStopped: body.data.suspend, subscriptionStatus: body.data.suspend ? 'SUSPENDED' : 'ACTIVE' }
+            });
+            return { ok: true };
+        } catch (err: any) {
+            if (err.code === 'P2025') return reply.code(404).send({ error: 'Organization not found' });
+            return reply.code(500).send({ error: 'Failed to suspend organization' });
+        }
+    });
+
+    // Impersonation — returns a short-lived JWT scoped to the target org
+    fastify.post<{ Params: { id: string } }>('/organizations/:id/impersonate', async (req, reply) => {
+        try {
+            const org = await prisma.organization.findUnique({ where: { id: req.params.id }, select: { id: true, name: true } });
+            if (!org) return reply.code(404).send({ error: 'Organization not found' });
+
+            const impersonateToken = (fastify as any).jwt.sign(
+                { id: (req as any).user.id, role: 'ORG_ADMIN', organizationId: org.id, impersonating: true },
+                { expiresIn: '1h' }
+            );
+            return { token: impersonateToken, orgName: org.name };
+        } catch (err) {
+            logger.error({ err }, '[SUPER_ADMIN] impersonate failed');
+            return reply.code(500).send({ error: 'Impersonation failed' });
+        }
+    });
+
+    // ── Users (cross-org) ─────────────────────────────────────────────────────
+    fastify.get('/users', async (req, reply) => {
+        const QuerySchema = z.object({
+            page: z.coerce.number().int().positive().default(1),
+            limit: z.coerce.number().int().positive().max(100).default(20),
+            orgId: z.string().optional(),
+            role: z.string().optional(),
+            search: z.string().optional(),
+        });
+        const parsed = QuerySchema.safeParse(req.query);
+        if (!parsed.success) return reply.code(400).send({ error: 'Invalid query params' });
+
+        const { page, limit, orgId, role, search } = parsed.data;
+        const where: any = { deletedAt: null };
+        if (orgId) where.organizationId = orgId;
+        if (role) where.role = role;
+        if (search) where.OR = [
+            { name: { contains: search, mode: 'insensitive' } },
+            { email: { contains: search, mode: 'insensitive' } },
+        ];
+
+        try {
+            const [users, total] = await Promise.all([
+                prisma.user.findMany({
+                    where,
+                    select: { id: true, name: true, email: true, phone: true, role: true, organizationId: true, createdAt: true, lastActivityAt: true,
+                        organization: { select: { name: true } }
+                    },
+                    orderBy: { createdAt: 'desc' },
+                    skip: (page - 1) * limit,
+                    take: limit,
+                }),
+                prisma.user.count({ where }),
+            ]);
+            return { data: users, total, page, limit };
+        } catch (err) {
+            logger.error({ err }, '[SUPER_ADMIN] users list failed');
+            return reply.code(500).send({ error: 'Failed to list users' });
+        }
+    });
+
+    fastify.patch<{ Params: { userId: string } }>('/users/:userId/role', async (req, reply) => {
+        const Schema = z.object({ role: z.enum(['STUDENT', 'ORG_MEMBER', 'ORG_ADMIN', 'ADMIN', 'SUPER_ADMIN']) });
+        const body = Schema.safeParse(req.body);
+        if (!body.success) return reply.code(400).send({ error: body.error.flatten() });
+        try {
+            const user = await prisma.user.update({ where: { id: req.params.userId }, data: { role: body.data.role } });
+            return { ok: true, role: user.role };
+        } catch (err: any) {
+            if (err.code === 'P2025') return reply.code(404).send({ error: 'User not found' });
+            return reply.code(500).send({ error: 'Failed to update role' });
+        }
+    });
+
+    // ── WhatsApp Numbers (cross-org) ──────────────────────────────────────────
+    fastify.get('/whatsapp/numbers', async (_req, reply) => {
+        try {
+            const numbers = await prisma.whatsAppPhoneNumber.findMany({
+                include: { organization: { select: { id: true, name: true } } },
+                orderBy: { createdAt: 'desc' },
+            });
+            return { data: numbers };
+        } catch (err) {
+            logger.error({ err }, '[SUPER_ADMIN] whatsapp numbers failed');
+            return reply.code(500).send({ error: 'Failed to list phone numbers' });
+        }
+    });
+
+    // ── Billing ───────────────────────────────────────────────────────────────
+    fastify.get('/billing/transactions', async (req, reply) => {
+        const QuerySchema = z.object({
+            page: z.coerce.number().int().positive().default(1),
+            limit: z.coerce.number().int().positive().max(100).default(20),
+            orgId: z.string().optional(),
+        });
+        const parsed = QuerySchema.safeParse(req.query);
+        if (!parsed.success) return reply.code(400).send({ error: 'Invalid query params' });
+
+        const { page, limit, orgId } = parsed.data;
+        const where: any = {};
+        if (orgId) where.organizationId = orgId;
+
+        try {
+            const [txns, total] = await Promise.all([
+                prisma.walletTransaction.findMany({
+                    where,
+                    include: { organization: { select: { id: true, name: true } } },
+                    orderBy: { createdAt: 'desc' },
+                    skip: (page - 1) * limit,
+                    take: limit,
+                }),
+                prisma.walletTransaction.count({ where }),
+            ]);
+            return { data: txns, total, page, limit };
+        } catch (err) {
+            logger.error({ err }, '[SUPER_ADMIN] billing transactions failed');
+            return reply.code(500).send({ error: 'Failed to list transactions' });
+        }
+    });
+
+    fastify.post('/billing/credits', async (req, reply) => {
+        const Schema = z.object({
+            orgId: z.string(),
+            amount: z.number().int().positive(),
+            description: z.string().optional(),
+        });
+        const body = Schema.safeParse(req.body);
+        if (!body.success) return reply.code(400).send({ error: body.error.flatten() });
+
+        try {
+            const org = await prisma.organization.findUnique({ where: { id: body.data.orgId }, select: { walletBalance: true } });
+            if (!org) return reply.code(404).send({ error: 'Organization not found' });
+
+            const newBalance = org.walletBalance + body.data.amount;
+            const [updatedOrg, txn] = await prisma.$transaction([
+                prisma.organization.update({ where: { id: body.data.orgId }, data: { walletBalance: newBalance } }),
+                prisma.walletTransaction.create({
+                    data: {
+                        organizationId: body.data.orgId,
+                        amount: body.data.amount,
+                        balanceAfter: newBalance,
+                        type: 'TOP_UP_MANUAL',
+                        description: body.data.description || 'Manual credit by super-admin',
+                        actorId: (req as any).user?.id,
+                    }
+                })
+            ]);
+            return { ok: true, newBalance: updatedOrg.walletBalance, transactionId: txn.id };
+        } catch (err) {
+            logger.error({ err }, '[SUPER_ADMIN] add credits failed');
+            return reply.code(500).send({ error: 'Failed to add credits' });
+        }
+    });
+
+    // ── Monitoring ─────────────────────────────────────────────��──────────────
+    fastify.get('/monitoring/health', async (_req, reply) => {
+        try {
+            const [dbPing, redisPing, queueWaiting, queueFailed, queueActive] = await Promise.all([
+                prisma.$queryRaw`SELECT 1`.then(() => true).catch(() => false),
+                redis.ping().then(() => true).catch(() => false),
+                whatsappQueue.getWaitingCount().catch(() => -1),
+                whatsappQueue.getFailedCount().catch(() => -1),
+                whatsappQueue.getActiveCount().catch(() => -1),
+            ]);
+
+            // Token expiry check — find orgs with systemUserTokenIssuedAt older than 50 days
+            const tokenExpiryThreshold = new Date(Date.now() - 50 * 24 * 60 * 60 * 1000);
+            const expiringTokenOrgs = await prisma.organization.findMany({
+                where: {
+                    systemUserTokenIssuedAt: { lte: tokenExpiryThreshold },
+                    systemUserToken: { not: null }
+                },
+                select: { id: true, name: true, systemUserTokenIssuedAt: true }
+            });
+
+            // Low wallet balance
+            const lowBalanceOrgs = await prisma.organization.findMany({
+                where: { walletBalance: { lt: 100 }, isHardStopped: false },
+                select: { id: true, name: true, walletBalance: true }
+            });
+
+            return {
+                db: { ok: dbPing },
+                redis: { ok: redisPing },
+                queue: { waiting: queueWaiting, failed: queueFailed, active: queueActive },
+                tokenExpiries: expiringTokenOrgs.map(o => ({
+                    orgId: o.id,
+                    orgName: o.name,
+                    issuedAt: o.systemUserTokenIssuedAt,
+                    daysOld: o.systemUserTokenIssuedAt
+                        ? Math.floor((Date.now() - o.systemUserTokenIssuedAt.getTime()) / (24 * 60 * 60 * 1000))
+                        : null
+                })),
+                lowBalanceOrgs,
+            };
+        } catch (err) {
+            logger.error({ err }, '[SUPER_ADMIN] monitoring failed');
+            return reply.code(500).send({ error: 'Failed to fetch monitoring data' });
+        }
+    });
+
+    // ── AI Agentic Command ────────────────────────────────────────────────────
+    fastify.post('/ai/command', async (req, reply) => {
+        const Schema = z.object({
+            command: z.string().min(1),
+            confirm: z.boolean().default(false),
+            pendingAction: z.object({
+                action: z.string(),
+                params: z.record(z.unknown()),
+            }).optional(),
+        });
+        const body = Schema.safeParse(req.body);
+        if (!body.success) return reply.code(400).send({ error: body.error.flatten() });
+
+        const { command, confirm, pendingAction } = body.data;
+
+        // If confirming a pending action
+        if (confirm && pendingAction) {
+            return executeSuperAdminAction(pendingAction.action, pendingAction.params, req, reply);
+        }
+
+        // Parse command with AI
+        const { aiService } = await import('../services/ai');
+        const { z: zod } = await import('zod');
+
+        const CommandSchema = zod.object({
+            action: zod.enum(['QUERY_STATS', 'LIST_ORGS', 'SUSPEND_ORG', 'ACTIVATE_ORG', 'ADD_CREDITS', 'LIST_LOW_BALANCE', 'LIST_ALERTS', 'LIST_USERS']),
+            params: zod.record(zod.unknown()).default({}),
+            confirmation_required: zod.boolean(),
+            human_summary: zod.string(),
+        });
+
+        try {
+            const systemPrompt = `You are a super-admin AI assistant for the XAMLÉ platform. Parse the admin's command and return a structured action.
+Available actions:
+- QUERY_STATS: Get platform statistics (no params needed)
+- LIST_ORGS: List organizations (params: search?, plan?)
+- SUSPEND_ORG: Suspend an organization (params: orgName or orgId) — confirmation required
+- ACTIVATE_ORG: Reactivate a suspended org (params: orgName or orgId) — confirmation required
+- ADD_CREDITS: Add wallet credits to an org (params: orgName or orgId, amount) — confirmation required
+- LIST_LOW_BALANCE: List orgs with low wallet balance
+- LIST_ALERTS: List monitoring alerts
+- LIST_USERS: List users (params: orgName?, role?)
+
+Always extract organization names and amounts from the command. Set confirmation_required=true for destructive or financial actions.`;
+
+            const { data: parsed } = await aiService.generateStructuredData(
+                `${systemPrompt}\n\nAdmin command: "${command}"`,
+                CommandSchema,
+                0.1
+            );
+
+            if (parsed.confirmation_required) {
+                return {
+                    status: 'pending_confirmation',
+                    summary: parsed.human_summary,
+                    action: parsed.action,
+                    params: parsed.params,
+                };
+            }
+
+            return executeSuperAdminAction(parsed.action, parsed.params ?? {}, req, reply);
+        } catch (err) {
+            logger.error({ err }, '[SUPER_ADMIN] AI command failed');
+            return reply.code(503).send({ error: 'AI service unavailable' });
+        }
+    });
+}
+
+async function executeSuperAdminAction(action: string, params: Record<string, unknown>, req: any, reply: any) {
+    try {
+        switch (action) {
+            case 'QUERY_STATS': {
+                const since24h = new Date(Date.now() - 24 * 60 * 60 * 1000);
+                const [orgsCount, usersCount, messagesLast24h] = await Promise.all([
+                    prisma.organization.count(),
+                    prisma.user.count({ where: { deletedAt: null } }),
+                    prisma.message.count({ where: { createdAt: { gte: since24h } } }),
+                ]);
+                return { status: 'success', result: { orgsCount, usersCount, messagesLast24h } };
+            }
+            case 'LIST_ORGS': {
+                const orgs = await prisma.organization.findMany({
+                    where: params.search ? { name: { contains: params.search as string, mode: 'insensitive' } } : undefined,
+                    select: { id: true, name: true, subscriptionPlan: true, walletBalance: true, isHardStopped: true },
+                    take: 20,
+                    orderBy: { createdAt: 'desc' },
+                });
+                return { status: 'success', result: orgs };
+            }
+            case 'LIST_LOW_BALANCE': {
+                const orgs = await prisma.organization.findMany({
+                    where: { walletBalance: { lt: 100 } },
+                    select: { id: true, name: true, walletBalance: true },
+                    orderBy: { walletBalance: 'asc' },
+                });
+                return { status: 'success', result: orgs };
+            }
+            case 'LIST_ALERTS': {
+                const tokenThreshold = new Date(Date.now() - 50 * 24 * 60 * 60 * 1000);
+                const [expiringTokens, lowBalance] = await Promise.all([
+                    prisma.organization.findMany({
+                        where: { systemUserTokenIssuedAt: { lte: tokenThreshold }, systemUserToken: { not: null } },
+                        select: { id: true, name: true, systemUserTokenIssuedAt: true },
+                    }),
+                    prisma.organization.findMany({
+                        where: { walletBalance: { lt: 100 } },
+                        select: { id: true, name: true, walletBalance: true },
+                    }),
+                ]);
+                return { status: 'success', result: { expiringTokens, lowBalance } };
+            }
+            case 'SUSPEND_ORG':
+            case 'ACTIVATE_ORG': {
+                const suspend = action === 'SUSPEND_ORG';
+                const orgSearch = (params.orgName || params.orgId) as string;
+                const org = await prisma.organization.findFirst({
+                    where: params.orgId
+                        ? { id: params.orgId as string }
+                        : { name: { contains: orgSearch, mode: 'insensitive' } }
+                });
+                if (!org) return reply.code(404).send({ error: `Organization not found: ${orgSearch}` });
+                await prisma.organization.update({
+                    where: { id: org.id },
+                    data: { isHardStopped: suspend, subscriptionStatus: suspend ? 'SUSPENDED' : 'ACTIVE' }
+                });
+                return { status: 'success', result: { orgId: org.id, orgName: org.name, action: suspend ? 'suspended' : 'activated' } };
+            }
+            case 'ADD_CREDITS': {
+                const orgSearch = (params.orgName || params.orgId) as string;
+                const amount = typeof params.amount === 'number' ? params.amount : parseInt(params.amount as string, 10);
+                if (!amount || amount <= 0) return reply.code(400).send({ error: 'Invalid amount' });
+                const org = await prisma.organization.findFirst({
+                    where: params.orgId
+                        ? { id: params.orgId as string }
+                        : { name: { contains: orgSearch, mode: 'insensitive' } }
+                });
+                if (!org) return reply.code(404).send({ error: `Organization not found: ${orgSearch}` });
+                const newBalance = org.walletBalance + amount;
+                await prisma.$transaction([
+                    prisma.organization.update({ where: { id: org.id }, data: { walletBalance: newBalance } }),
+                    prisma.walletTransaction.create({
+                        data: {
+                            organizationId: org.id,
+                            amount,
+                            balanceAfter: newBalance,
+                            type: 'TOP_UP_MANUAL',
+                            description: `Super-admin AI command: add ${amount} credits`,
+                            actorId: req.user?.id,
+                        }
+                    })
+                ]);
+                return { status: 'success', result: { orgId: org.id, orgName: org.name, amount, newBalance } };
+            }
+            case 'LIST_USERS': {
+                const where: any = { deletedAt: null };
+                if (params.role) where.role = params.role;
+                if (params.orgName) {
+                    const org = await prisma.organization.findFirst({ where: { name: { contains: params.orgName as string, mode: 'insensitive' } } });
+                    if (org) where.organizationId = org.id;
+                }
+                const users = await prisma.user.findMany({ where, select: { id: true, name: true, email: true, role: true, organizationId: true }, take: 20 });
+                return { status: 'success', result: users };
+            }
+            default:
+                return reply.code(400).send({ error: `Unknown action: ${action}` });
+        }
+    } catch (err) {
+        logger.error({ err, action }, '[SUPER_ADMIN] action execution failed');
+        return reply.code(500).send({ error: 'Action execution failed' });
+    }
+}